REMARKS 



Claims 1-17, 20, and 22-34 are pending and stand rejected. No claims are amended 
herein and Applicants offer the following remarks. 

Claim Rejections under 35 U.S.C. $ 103 

Claims 1-10, 12-17, and 20-34 stand rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Bates et al., U.S. Patent 6,721,721, in view of Hericourt et al, U.S. Patent 
7,099,916. Claim 1 1 stands rejected as being unpatentable over the combination of Bates and 
Hericourt in view of Symantec, "Norton Antivirus Corporate Edition." Applicants respectfully 
traverse these rejections as applied to the current claims. 

The claimed invention uses a virus outbreak report indicating a virus attack to compute a 
computer virus alert time. The computer virus alert time is compared with a time stamp 
corresponding to an earliest moment or first time computer code was allowed to execute on a 
computer coupled to a computer network, and the executability of the computer code is 
determined in response to the comparison. Specifically, most of the independent claims recite 
limitations corresponding to: 

entering a first computer virus status mode in response to a first computer virus 
outbreak report indicating a virus attack threat to a computer network; 

computing a first computer virus alert time corresponding to entry into the first 
computer virus status mode; 

comparing a time stamp of executable computer code corresponding to an earliest 
moment the computer code was allowed to execute on a computer coupled to 
the computer network with the first computer virus alert time; and 

determining the executability of the computer code in response to the result of the 
comparing step. 

App. No. 10/046,496 - 11 - 

20423/05957/SF/5239677.1 



(quoting from claim 1). Dependent claim 8 further recites that the "computer code is determined 
to be executable only when the computer code is time stamped prior to the first computer virus 
alert time." In other words, the computer code is executable because it executed before the virus 
alert and, therefore, is unlikely to be infected by the virus implicated in the alert. Independent 
claim 34 resembles claim 1, except that the time stamp of the executable computer code 
corresponds "to a first time the computer code was allowed to execute on a computer coupled to 
the computer network." 

The cited references, at the least, fail to disclose a time stamp "corresponding to an 
earliest moment the computer code was allowed to execute on a computer. . ." or "corresponding 
to a first time the computer code was allowed to execute on a computer. . ." Bates discloses a 
system that integrates virus checking functionality into a computer database search environment, 
thereby allegedly decreasing the risks of viruses associated with accessing search results from 
computer database searches. See Bates, Abstract; column 3, lines 1-3. At col. 9, line 56 - col. 
10, line 8, Bates describes how the user can assess the "trustworthiness" of a search result file by 
setting a virus criterion as to (i) whether the file has been virus checked within a predetermined 
period of time; (ii) whether the file has been changed since the last time a virus check was 
performed; or (iii) whether a particular period of time has elapsed in which the file has been 
found to be free of viral infection. Thus Bates at most discloses use of a single time stamp 
indicating the time the file was last checked for a virus. There is no teaching or suggestion in 
Bates of a time stamp that indicates the earliest moment or first time computer code was allowed 
to execute. 

In fact, Bates does not even teach or suggest recording computer code execution times. 
The Examiner acknowledges this deficiency of Bates, and seeks to cure it by citing to Hericourt. 
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This latter reference provides an overview of antivirus software, and describes how a suspect file 
can be executed in a protected location to see if it exhibits any virus-like behavior. Hericourt, 
col. 3, lines 52-54. Hericourt does not teach or suggest using timestamps for any purpose. 
However, the Examiner alleges that Hericourt teaches that scanning a file can comprise an 
execution of the file. Therefore, according to the Examiner, when Bates and Hericourt are 
combined Bates' timestamp indicating when a file was found free of a viral infection becomes a 
timestamp indicating when the file was executed. 

The combination of Bates and Hericourt does not render the claimed invention obvious 
because neither reference discloses or suggests using a time stamp that corresponds to an earliest 
moment, or first time, the computer code was allowed to execute on a computer coupled to a 
computer network. If the references are combined in the manner suggested by the Examiner, the 
time stamp at most represents a code execution occurring at an arbitrary time. Neither reference 
teaches or suggests time stamping the earliest or first time code was executed, and there might 
have been prior executions occurring before the timestamp. Moreover, even if a particular 
timestamp in Bates did represent the earliest code execution, this happenstance event would not 
support the rejection. See In re Robertson, 169 F.3d 743, 745 (Fed. Cir. 1999) (stating that the 
mere fact that a certain thing may result from a given set of circumstances is not sufficient to 
support a rejection based on inherency); MPEP 2112 IV. Thus, a person of ordinary skill in the 
art at the time the invention was made, considering the teachings of the references either alone or 
in combination, would not find the claimed invention obvious. 

The Examiner's defense of this rejection is essentially predicated on an unreasonable 
interpretation of the claims. Claims must be given their broadest reasonable interpretation 
consistent with the specification. Phillips v. AWHCorp., 415 F.3d 1303 (Fed. Cir. 2005); MPEP 

App. No. 10/046,496 - 13 - 

20423/05957/SF/5239677.1 



§ 21 1 1. Here, the Examiner's interpretation is unreasonable because it calls code executions 
"earliest" or "first" even if prior code executions have occurred. 

The unreasonableness of the Examiner's interpretation is demonstrated through 
Applicants' and the Examiner's exchanges concerning this rejection. In a previous Office 
Action, the Examiner supported the rejection by stating that code can be executed multiple times, 
and that: 

. . .out of the multitude of instances a particular piece of computer code is 
executed, either via scanning or via end-user execution, the timestamp associated 
with the virus check for that computer code represents "an earliest execution 
time" in comparison to subsequent instances of execution for that piece of 
computer code. 

(Office Action of January 11, 2008, page 18 lines 2-6). In response, Applicants argued that: 

a particular timestamp in Bates cannot be said to represent the "earliest" execution 
because there are an arbitrary number of executions that occur before and after the 
execution represented by the timestamp. 

(Amendment of April 10, 2008, page 14 lines 18-21). Thus, Applicants argued that there can be 

any number of executions before and after a given execution, and no timestamp in Bates 

necessarily represents the earliest or first execution. 

The Examiner now asserts that Applicants have "admitted" that the time stamped 

'"execution time' is subsequently followed by a plurality of executions of the software." (Office 

Action of July 10, 2008, page 4 lines 12-14). And, therefore, Applicants 

reasonably must also acknowledge that within such a sequence the time-stamped 
execution represents "an earliest" time of execution in comparison to the 
subsequent executions within that sequence 

(Office Action of July 10, 2008, page 17, lines 10-13, emphasis in original). 

In other words, the Examiner calls any given time stamped execution the "earliest" or 

"first" one by arbitrarily excluding from consideration any executions that came before it. For 

example, if there were three sequential executions, the Examiner would call execution two "an 
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earliest" execution because it occurred before execution three, even though execution one 
occurred earlier. This interpretation is improper because it is clearly unreasonable. 

The Symantec reference fails to remedy the deficiencies of Bates and Hericourt described 
above. Therefore, a person of ordinary skill in the art, considering the teachings of the 
references either alone or in combination would not find the claimed invention obvious. 

CONCLUSION 

Accordingly, Applicants respectfully submit that the pending claims are allowable over 
the cited references and request allowance of the claims. If the Examiner believes that direct 
contact with the Applicants' attorney will advance the prosecution of this case, the Examiner is 
encouraged to contact the undersigned as indicated below. 

Respectfully submitted, 

CAREY S. NACHENBERG, ET AL. 



Dated: September 9, 2008 By: /Brian Hoffman/ 

Brian M. Hoffman, Reg. No. 39,713 
Attorney for Applicants 
Fenwick & West LLP 
801 California Street 
Mountain View, CA 94041 
Tel.: (415)875-2484 
Fax: (415)281-1350 
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